SIP: A Five-Control Starter Plan for Securing Java Software Supply Chains

·4 views

A DEV Community article proposes the Security Immediate Plan (SIP), a set of five practical controls for Java teams that want to secure their software supply chain without a full pipeline overhaul. The plan covers isolating local AI coding agents in sandboxed environments with restricted network access, and freezing unvetted Maven or Gradle dependencies and build plugins. It also recommends building applications in hardened multi-stage containers with a minimal non-root runtime image. Further steps include generating SBOMs and provenance attestations for both runtime and build stages, then scanning those inventories against vulnerability policies before release. The authors provide a companion repository with a sample Spring Boot application, Dockerfiles, and a scanning script.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ShortSingh: Browser Tool Sorts Lines Numerically or Case-Sensitively, Keeping Text Local

OnePassApps has described its Text Studio's Sort lines tab, which runs entirely in the browser tab so files are not uploaded. The tool offers A-to-Z or Z-to-A ordering, a case-sensitive option, and natural number ordering, which is enabled by default. With natural ordering on, numbers sort by numeric value, so 9 comes before 10, whereas plain text sorting places 10 first. The article notes that case-sensitivity only changes results when two lines differ solely in capitalization, and that natural ordering suits IDs but may be better turned off for version strings.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

High-accuracy classifier can still miss every useful research candidate

A synthetic teaching example shows that a screening classifier scoring 95% accuracy on 100 records can find none of the five positive candidates. The article explains why accuracy alone hides which cases were missed. Precision and recall are compared across two constructed prediction sets, showing that catching more positives can come with more false positives. The author stresses that the labels and predictions are invented for illustration and are not measurements from a real model or laboratory. A short Python audit script is provided that computes confusion-matrix counts, accuracy, precision and recall without external data or dependencies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How JEE Main converts marks to percentiles and ranks across 19 shifts

About 15 lakh students take JEE Main across 19 shifts, each with a different paper, so raw marks cannot be compared directly. The testing agency NTA converts marks to a percentile calculated within each shift, meaning the same score can yield a higher percentile in a tougher shift. Because NTA does not publish a marks-to-percentile table, predictors must build one from published (marks, percentile) pairs and interpolate between them. Rank is then estimated by applying the share of candidates above a given percentile to the total number of candidates across all shifts. The author notes that such predictions are estimates and recommends displaying a range rather than a single figure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why '.map is not a function' Errors Occur: The Value Is Not an Array

A common JavaScript error, '.map is not a function', does not signal a problem with the map method itself. It means the value being called is not an array, such as an object, a Set, or an unparsed string. Array-like values such as NodeLists also trigger it, since they lack array methods. Developers can diagnose the issue by logging the value's type and checking it with Array.isArray. Depending on the cause, the fix may involve accessing the nested array, converting the value with spread syntax or Array.from, parsing JSON, or using Object.entries.

0 comments Read more at DEV Community